FINANCIAL CRIME RISK ASSESSMENT (FCRA) & SYSTEMS EFFECTIVENESS TESTING

Financial Crime Risk Assessment (FCRA)

Structured, methodology-driven ML/TF/PF risk assessment underpinning the CBUAE and FATF risk-based approach

• 
  Business-Wide Risk Assessment (BWRA) — customers, products, channels & geographies
• 
  Proliferation Financing Risk Assessment (PFRA) — standalone, per FATF 2021 & CBUAE CPF Standards
• 
  Sectoral risk assessments — banks, exchange houses, DNFBPs & VASPs
• 
  Customer risk-rating model — scoring matrices, override procedures & periodic recalibration
• 
  Residual risk scoring — inherent risks mapped against existing control effectiveness
• 
  Annual FCRA refresh — incorporating NRA/SRA updates, new typologies & internal risk events
• 
  Board-ready FCRA report — structured for CBUAE examination & FATF Mutual Evaluation review

TMS — Systems Effectiveness Testing (ATL & BTL)

End-to-end assessment of transaction monitoring performance across active and suppressed rule populations.

• 
  ATL (Above-the-Line) testing — validate rules fire correctly; thresholds calibrated against actual transaction patterns
• 
  BTL (Below-the-Line) testing — systematic review of all suppressed, disabled & whitelisted rules; confirm no ML/TF/PF risk masked
• 
  False-positive analysis — alert volume benchmarking, alert-to-STR conversion rate, alert-fatigue identification
• 
  True-positive validation — back-test rules against confirmed STR cases & known typologies
• 
  Threshold recalibration — data-driven recommendations to optimise alert quality without compromising detection
• 
  Scenario gap analysis — identify ML/TF/PF typologies not covered by any active rule
• 
  New scenario design — business requirements for new/enhanced rules to close coverage gaps
• 
  Post-implementation review — PIR following TMS upgrades, migrations or parameter changes

Sanctions & Name Screening — Effectiveness Testing

Testing end-to-end sanctions screening controls across onboarding, periodic review, and real-time payment screening.

• 
  List coverage audit — UN, OFAC, EU, HM Treasury & UAE LTDL — all mandatory lists confirmed
• 
  Fuzzy matching & transliteration — Arabic name variants, phonetic similarities & common aliases
• 
  Threshold & sensitivity testing — match-score thresholds balanced for false-positive management vs. detection
• 
  Whitelist review — all suppressed/cleared matches tested for ongoing validity
• 
  Payment screening latency — confirm screening occurs pre-execution; payment-hold procedures validated
• 
  List update frequency — timeliness of list refreshes & escalation when existing customers become newly designated
• 
  Hit management workflow — alert → analyst → MLRO → regulatory reporting end-to-end review

System Fine-Tuning & Model Risk Management

Ongoing optimization ensuring systems stay aligned with the institution’s evolving risk profile and UAE regulatory developments

• 
  Tuning cycle management — structured quarterly/semi-annual reviews; tuning log maintained per CBUAE standards
• 
  Model risk governance — TMS validation, change management, version control & independent model review policy
• 
  Risk-based segmentation review — correct monitoring scenarios applied to the right customer/transaction population
• 
  Typology integration — MENAFATF, UAEFIU intelligence & FATF Guidance translated into rule enhancements
• 
  Data quality assessment — field-mapping errors, data-feed gaps causing missed or misfired rules
• 
  Alert workflow optimization — queue management, ageing, escalation triggers & closure documentation
• 
  Vendor & procurement support — RFP evaluation, TMS implementation advisory & vendor-delivered testing oversight
• 
  SET Report — regulator-ready documentation for CBUAE, external auditors & correspondent banks